8d2fc42cefceba6c8b52b9496d142d5985fc4b85f1a95ca6d3a26221231bbb06

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 13:15

Target

c375432cd7ec91efa2a9383352aa0c6e.exe
Size

55KB
MD5

c375432cd7ec91efa2a9383352aa0c6e
SHA1

d75c95c8f5186a1ff0f0a79dda0049e6045139da
SHA256

8d2fc42cefceba6c8b52b9496d142d5985fc4b85f1a95ca6d3a26221231bbb06
SHA512

9effceb3945dcca7bfe622c38205d82f73fb8ec450e48b4730e8b8eea3fe353a1e7ba930216273d0397c87aacc82756a7783c062c088aff4d6093431505ba566
SSDEEP

768:LWPK4WyZPvXiwv/kiavoGDhsxzrRGwmEuXheLfjP4VsH3bRkflcJY3HJmCRlxYhE:LqbZPPkiagrrMwm/heLLP4e3g+a3NUE

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1000	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\e2fe90291a.dll	c375432cd7ec91efa2a9383352aa0c6e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1000	1072	c375432cd7ec91efa2a9383352aa0c6e.exe	32
PID 1072 wrote to memory of 1000	1072	c375432cd7ec91efa2a9383352aa0c6e.exe	32
PID 1072 wrote to memory of 1000	1072	c375432cd7ec91efa2a9383352aa0c6e.exe	32
PID 1072 wrote to memory of 1000	1072	c375432cd7ec91efa2a9383352aa0c6e.exe	32

C:\Users\Admin\AppData\Local\Temp\c375432cd7ec91efa2a9383352aa0c6e.exe
"C:\Users\Admin\AppData\Local\Temp\c375432cd7ec91efa2a9383352aa0c6e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$30689.bat
  2⤵
  - Deletes itself
  PID:1000

C:\Users\Admin\AppData\Local\Temp\$$30689.bat

Filesize
181B

MD5
2f42b06c7d6f39424f49e984880b2608

SHA1
fedf9d82b4d2f9e9d037d3fa3c1efacd27451efa

SHA256
c38fefa611c9004e72cd64c2ac96bf2daa51b6b861aa2394126f9585a49b81aa

SHA512
bb19a69c2cf8e91e811cdc6d597412afe6b49b225bb81da78aec60ea08f1f9b91f6c1daeef3816f92461a3b0bee194f6e965fbff042bb2fe1801136cefdd77a4

Download Submit
memory/1072-0-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1072-1-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1072-2-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1072-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1072-4-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1072-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download